# US 2016/0366127 A1 · Network node, device and methods for providing an authentication module

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366127 A1
- Document ID: US20160366127A1
- Status: Published application
- Kind: A1
- Application number: 15/121,490
- Filed: 2014-03-06
- Published: 2016-12-15
- Earliest claimed: 2014-03-06
- Assignees: Telefonaktiebolaget LM Ericsson (publ)
- Inventors: Gustavo Tanoni
- Web page: https://patentgrep.com/patent/US20160366127A1

## CPC

- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/06: Authentication
- H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning}
- H04W 12/72: Subscriber identity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The invention relates to a method, for providing an Authentication Module (AM) to a device. The method comprises computing an authentication parameter to be stored in the AM, using an identifier (ID) associated with the device, authentication data associated with the device and an encryption parameter associated with the device. The method also comprises providing the AM to the device. The invention also relates to a method, for updating an AM and to a method to authenticate a device using an AM. The invention further relates to a device and network node executing the methods.

## Claims

### Claim 1

A method, executed in a network node, for providing an Authentication Module (AM) to a device, comprising the steps of:
computing an authentication parameter to be stored in the AM, using an identifier (ID) associated with the device, authentication data associated with the device and an encryption parameter associated with the device; and
providing the AM to the device.

### Claim 2 (depends on 1)

The method of claim 1, further comprising the steps of:
receiving a request for the AM from the device;
receiving a request for the ID from the device;
providing the ID to the device; and
providing the ID and the authentication parameter to a database for subsequent authentication use.

### Claim 3 (depends on 2)

The method of claim 2, wherein the request comprises at least one of: the ID associated with the device, the authentication data associated with the device and the encryption parameter associated with the device and wherein the authentication data comprises at least one of: an authentication sequence, a user data, a vendor data and a service provider data.

### Claim 4

(canceled)

### Claim 5 (depends on 1)

The method of claim 1, wherein the authentication parameter is computed using an Advanced Encryption Standard (AES) algorithm taking as inputs a concatenation of the ID, the authentication data associated with the device and the encryption parameter associated with the device, wherein the concatenation of the ID and the authentication data associated with the device used for computing the authentication parameter is in the form of a string generated using Basic Encoding Rules (BER) and wherein the computed authentication parameter is stored as an Operator Variant Algorithm Configuration Field (OP) parameter in the AM.

### Claim 6

(canceled)

### Claim 7

(canceled)

### Claim 8 (depends on 1)

The method of claim 1 wherein the authentication parameter of the AM is set to empty, to a dummy value, to a default value or to the computed authentication parameter, before providing the AM to the device, when the device has capabilities to compute the authentication parameter.

### Claim 9 (depends on 1)

The method of claim 1 wherein the authentication parameter of the AM is set to the computed authentication parameter, before providing the AM to the device, when the device has no capabilities to compute the authentication parameter.

### Claim 10 (depends on 1)

The method of claim 1 wherein, prior to being provided to the device, the AM is encrypted using the encryption parameter associated with the device, wherein the AM is provided to the device by sending the AM from the network node to the device or by enabling a download of the AM from the network node, or the AM is transferred from the network node to a portable data repository and the AM is uploaded from the portable data repository to the device by wired or by short range wireless transmission.

### Claim 11

(canceled)

### Claim 12

(canceled)

### Claim 13

(canceled)

### Claim 14

(canceled)

### Claim 15 (depends on 10)

The method of claim 10 wherein the database is a Home Subscriber System (HSS), wherein the network node is operative to execute a Bootstrapping Server Function (BSF) and wherein the network node executing the BSF is operative to communicate with a Home Subscriber System (HSS).

### Claim 16

(canceled)

### Claim 17

(canceled)

### Claim 18 (depends on 1)

The method of claim 1 wherein the ID and the authentication data are stored in the AM.

### Claim 19 (depends on 1)

The method of claim 1 wherein the device is a Machine-to-Machine (M2M) communication device or a user equipment (UE).

### Claim 20 (depends on 1)

The method of claim 1 wherein the ID is an Internet Protocol (IP) Multimedia Subsystem (IMS) Private Identity (IMPI) and wherein the AM is a virtual Subscriber Identity Module (vSIM).

### Claim 21

(canceled)

### Claim 22 (depends on 1)

The method of claim 1, further for updating the AM of a device, further comprising the steps of:
computing a new authentication parameter to be stored in the AM, using the ID associated with the device, updated authentication data associated with the device and the encryption parameter associated with the device; and
providing the updated authentication data to the device.

### Claim 23 (depends on 22)

The method of claim 22 further comprising the steps of:
receiving a request for the updated AM from the device;
providing the new authentication parameter to the device; and
providing the ID and the new authentication parameter to a database for subsequent authentication use.

### Claim 24

(canceled)

### Claim 25

(canceled)

### Claim 26

A method, executed in a device, for authenticating the device using an Authentication Module (AM), comprising the steps of:
sending an authentication request to a network node;
receiving a response comprising a random string and a verification code;
computing an expected verification code using the random string and an authentication parameter stored in the AM; and
authenticating the device responsive to determining that the received verification code corresponds to the expected verification code;
wherein the authentication parameter stored in the AM is computed using an identifier (ID) associated with the device, authentication data associated with the device and an encryption parameter associated with the device.

### Claim 27 (depends on 26)

The method of claim 26 wherein the authentication parameter stored in the AM is an Operator Variant Algorithm Configuration Field (OP) parameter, wherein the random string is a random string of numbers, wherein the verification codes are Media Authorization Codes (MACs) and wherein the network node is a Bootstrapping Server Function (BSF) in communication with an Home Subscriber System (HSS) operative to provide a copy of the authentication parameter associated with the device to the network node for computation of the expected verification code.

### Claim 28

(canceled)

### Claim 29

(canceled)

### Claim 30

(canceled)

### Claim 31

A method for generating an authentication parameter for an Authentication Module (AM), comprising the step of:
computing an authentication parameter to be stored in the AM, using an identifier (ID) associated with a device, authentication data associated with the device and an encryption parameter associated with the device.

### Claim 32 (depends on 31)

The method of claim 31 wherein the ID and the authentication data are stored in the AM.

### Claim 33 (depends on 31)

The method of claim 31 wherein the authentication parameter is computed using an Advanced Encryption Standard (AES) algorithm taking as inputs a concatenation of the ID and the authentication data associated with the device and the encryption parameter associated with the device and wherein the authentication parameter stored in the AM is an Operator Variant Algorithm Configuration Field (OP) parameter.

### Claim 34

(canceled)

### Claim 35 (depends on 31)

The method of claim 31, wherein the AM is stored in a repository of the device and wherein the AM is stored in at least two different files in the repository of the device.

### Claim 36

(canceled)

### Claim 37

A network node for providing an Authentication Module (AM) to a device comprising: a processor; and a memory, said memory containing instructions executable by said processor, whereby said network node is operative to:
compute an authentication parameter to be stored in the AM, using an identifier (ID) associated with the device, authentication data associated with the device and an encryption parameter associated with the device; and
provide the AM to the device.

### Claim 38 (depends on 37)

The network node of claim 37, wherein the network node is a Bootstrapping Server Function (BSF).

### Claim 39

A device using an Authentication Module (AM) comprising: a processor; and a memory, said memory containing instructions executable by said processor, whereby said device is operative to:
send an authentication request to a network node;
receive a response comprising a random string and a verification code;
compute an expected verification code using the random string and an authentication parameter stored in the AM; and
authenticate the device responsive to determining that the received verification code corresponds to the expected verification code;
wherein the authentication parameter stored in the AM is computed using an identifier (ID) associated with the device, authentication data associated with the device and an encryption parameter associated with the device.

### Claim 40

(canceled)

### Claim 41

(canceled)